The Great Firewall (GFW; Chinese: 防火墙; pinyin: Fánghuǒ Qiáng) is the combination of legislative actions and technologies enforced by the People's Republic of China to regulate the Internet domestically. Its role in internet censorship in China is to block access to selected foreign websites and to slow down cross-border internet traffic. The Great Firewall was formerly operated by the State Internet Information Office, as part of the Golden Shield Project. Since 2013, the firewall is operated by the Cyberspace Administration of China (CAC), the national internet content regulator and censor of China.
The Great Firewall operates by checking transmission control protocol (TCP) packets for keywords or sensitive words. If the keywords or sensitive words appear in the TCP packets, access will be closed. If one link is closed, more links from the same machine will be blocked by the Great Firewall. The effect includes: limiting access to foreign information sources, blocking popular foreign websites and mobile apps, and requiring foreign companies to adapt to domestic regulations. Due to the Great Firewall, China has one of the lowest cross-border internet traffic rates in the world. Usage of foreign apps in China is minuscule; Asia Society estimated in 2026 that foreign apps blocked by the Great Firewall have extremely low traffic, particularly compared to domestic apps; the top five domestic apps saw traffic that was 1,000 times more than the top five foreign apps.
Besides censorship, the Great Firewall has also influenced the development of China's internal internet economy by giving preference to domestic companies and reducing the effectiveness of products from foreign internet companies. The techniques deployed by the Chinese government to maintain control of the Great Firewall can include modifying search results for terms, and petitioning global conglomerates to remove content, as happened when they petitioned companies to remove apps from their Chinese App Store.
Per the "one country, two systems" principle, China's special administrative regions (SARs)—Hong Kong and Macau—are not affected by the firewall, as SARs have their own governmental and legal systems and therefore have a higher degree of autonomy. Nevertheless, the U.S. State Department has reported that the central government authorities have closely monitored Internet use in these regions, and Hong Kong's National Security Law has been used to block websites documenting anti-government protests. Provincial governments in parts of China, such as Henan, run their own versions of the firewall.
Terminology
The term Great Firewall of China is a combination of the word firewall with the Great Wall of China. The phrase "Great Firewall of China" was first used in print by Australian sinologist Geremie Barmé in 1997. A year earlier, a CNN report from Beijing described how Chinese authorities were repurposing firewall technology to filter incoming information, quoting technology consultant Stephen Guerin of Redfish Group as saying they were "looking at firewall devices, which are originally designed from keeping people out of a network or a computer system" and "trying to turn that around and filter out the system coming in."
History
A favorite saying of Deng Xiaoping's in the early 1980s, "If you open the window, both fresh air and flies will be blown in", is considered to be the political and ideological basis of the GFW Project. The saying is related to the period of reform and opening up that led to the establishment of the socialist market economy. Superseding the political ideologies of the Cultural Revolution, the reform led China towards a market economy and opened up the market for foreign investors. Nonetheless, despite the economic freedom, values and political ideas of the Chinese Communist Party (CCP) have had to be protected by "swatting flies" of other unwanted ideologies.
The internet in China arrived in 1994, as the inevitable consequence of and supporting tool for a "socialist market economy". Gradually, while Internet availability has been increasing, the Internet has become a common communication platform and tool for trading information.
The Chinese government's control over the Internet began in 1996 when Premier Li Peng signed State Council Order No. 195, issuing the "Interim Regulations on the Management of International Networking of Computer Information Networks". Article 6 of the Regulations states: "Computer information networks that directly connect to the international network must use the international entry and exit channels provided by the Ministry of Posts and Telecommunications' national public telecommunications network. No unit or individual may establish or use other channels to connect to the international network on their own." This regulation was later widely used to punish "climbing over the firewall".
The Ministry of Public Security took initial steps to control Internet use in 1997, when it issued comprehensive regulations governing its use. The key sections, Articles 4–6, are:
Individuals are prohibited from using the Internet to: harm national security; disclose state secrets; or injure the interests of the state or society. Users are prohibited from using the Internet to create, replicate, retrieve, or transmit information that incites resistance to the PRC Constitution, laws, or administrative regulations; promoting the overthrow of the government or socialist system; undermining national unification; distorting the truth, spreading rumors, or destroying social order; or providing sexually suggestive material or encouraging gambling, violence, or murder. Users are prohibited from engaging in activities that harm the security of computer information networks and from using networks or changing network resources without prior approval.
In 1998, the Chinese Communist Party feared that the China Democracy Party (CDP) would breed a powerful new network that CCP elites might not be able to control. The CDP was immediately banned, followed by arrests and imprisonment. That same year, the GFW project was started. The first part of the project lasted eight years and was completed in 2006. The second part began in 2006 and ended in 2008. On 6 December 2002, 300 people in charge of the GFW project from 31 provinces and cities throughout China participated in a four-day inaugural "Comprehensive Exhibition on Chinese Information System". At the exhibition, many western high-tech products, including Internet security, video monitoring and human face recognition were purchased. It is estimated that around 30,000–50,000 police were employed in this gigantic project.
Fang Binxing is known for his substantial contribution to China's Internet censorship infrastructure, and has been dubbed "Father of China's Great Firewall".
Origins of Chinese Internet law
China's view of the Internet is one of "Internet sovereignty": the notion that the Internet inside the country is part of the country's sovereignty and should be governed by the country.
While the United States and several other western countries passed laws creating computer crimes beginning in the 1970s, China had no such legislation until 1997. That year, China's legislative body – the National People's Congress (NPC) – passed CL97, a law that deals with cyber crimes, which it divided into two broad categories: crimes that target computer networks, and crimes carried out over computer networks. Behavior illegal under the latter category includes, among many things, the dissemination of pornographic material, and the usurping of "state secrets."
Some Chinese judges were critical of CL97, calling it ineffective and unenforceable. However, the NPC claimed that it intentionally left the law "flexible" so that it could be open to future interpretation and development. Given the gaps in the law, the central government of China relies heavily on its administrative body, the State Council, to determine what falls under the definitions, and their determinations are not required to go through the NPC legislative process. As a result, the Chinese Communist Party has ended up relying heavily on state regulation to carry out CL97.
The latter definition of online activities punishable under CL97, or "crimes carried out over computer networks", is used as justification for the Great Firewall, and can be cited when the government blocks any ISP, gateway connections, or any access to anything on the internet. The definition also includes using the internet to distribute information considered "harmful to national security," and using the internet to distribute information considered "harmful to public order, social stability, and Chinese morality." The central government relies heavily on its State Council regulators to determine what specific online behavior and speech fall under these definitions.
The reasons behind the Internet censorship in China include:
- Social control: the Internet is a means for freedom of speech, and dissemination of campaigns could lead to protests against the government.
- Sensitive content: to control information about the government in China.
- Economic protectionism: China prefers the use of local companies that are regulated by Chinese regulations, since they have more power over them, e.g. Baidu over Google.
Campaigns and crackdowns
As part of the Great Firewall, beginning in 2003, China started the Golden Shield Project, a massive surveillance and censoring system, the hardware for which was provided by mostly U.S. companies, including Cisco Systems. The project was completed in 2006, and is now carried out in buildings with machines operated by civilians and supervised by China's national police force, the Public Security Bureau (PSB, Chinese: 公安局). The main operating procedures of the gatekeepers at the Golden Shield Project include monitoring domestic websites, email, and searching for politically sensitive language and calls to protest. When damaging content is found, local PSB officials can be dispatched to investigate or make arrests. However, by late 2007, the Golden Shield Project proved to operate sporadically at best, as users had long adapted to internet blocking by using proxy servers, among other strategies, to make communications and circumnavigate to blocked content.
Internet cafés, an extremely popular way of getting online in developing countries and where fewer people can afford a personal computer, are regulated by the Chinese government and by local Chinese government officials. Minors (in China, those under the age of 18) are not allowed into Internet cafés, although this law is widely ignored, and when enforced, has spurred the creation of underground "Black Web Bars" visited by those underage. As of 2008, internet cafés were required to register every customer in a log when they used the internet there. These records may be confiscated by either local government officials or the PSB. To illustrate local regulation of internet cafés, in one instance, a government official in the town of Gedong lawfully banned internet cafés from operating in the town because he believed them to be harmful to minors, who frequented them to play online games (including those considered violent) and surf the internet. However, internet cafés in this town simply went underground, and most minors were not deterred from visiting them.
In May 2015, China indefinitely blocked access to the Chinese-language Wikipedia. In 2017, China discussed plans for its own version of Wikipedia. As of May 2019, all language versions of Wikipedia have been blocked by the Chinese government.
Blocking methods
The Great Firewall is mainly deployed at three large internet exchanges in Beijing, Shanghai, and Guangzhou.
Active filtering
One function of the Chinese firewall is to selectively prevent content from being accessed. It is mostly made of Cisco, Huawei, and Semptian hardware. Not all sensitive content gets blocked; in 2007, scholar Jedidiah R. Crandall and others argued that the main purpose is not to block 100%, but rather to flag and to warn, in order to encourage self-censorship. An illustrative but incomplete list of tactics includes:
Active probing
In addition to previously discussed techniques, the CAC is also using active probing in order to identify and block network services that would help escaping the firewall. Multiple services such as Tor or VPN providers reported receiving unsolicited TCP/IP connections shortly after legitimate use, for the purported purpose of network enumeration of services, in particular TLS/SSL and Tor services, with the aim of facilitating IP blocking. For example, shortly after a VPN request is issued by a legitimate Chinese VPN client and passes outbound though the Great Firewall to a hidden VPN IP, the Great Firewall may detect the activity and issue its own active probe to verify the nature of the previously unknown VPN IP and, if the probe confirms the IP is part of a blacklisted VPN, blacklist the IP. This attack can be circumvented with the Obfs4 protocol, which relies on an out-of-band shared secret.
Proxy distribution
The Great Firewall scrapes the IPs of Tor and VPN servers from the official distribution channels, and enumerates them. The strategy to resist this attack is to limit the quantity of proxy IPs revealed to each user and making it very difficult for users to create more than one identity. Academics have proposed solutions such as Salmon, a volunteer-based proxy network designed to combat censorship. Dynamic IPs are quite effective to flush out from blacklists.
Goals, impact and resistance
Goal of the Firewall
Article 15 of a 20 September 2000 document from the State Council of China, posted by the Xinhua News Agency, lists 9 categories of information which should be censored, blocked, or filtered from access to the citizens using the internet within China: